CVE-2019-12402

7.5 highEPSS 16%

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 16% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-835
Published: 2019-08-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:commons_compress
fedoraproject:fedora
oracle:banking_payments
oracle:banking_platform
oracle:communications_element_manager
oracle:communications_ip_service_activator
oracle:communications_session_report_manager
oracle:communications_session_route_manager
oracle:customer_management_and_segmentation_foundation
oracle:essbase
oracle:flexcube_investor_servicing
oracle:flexcube_private_banking
oracle:hyperion_infrastructure_technology
oracle:jdeveloper
oracle:peoplesoft_enterprise_pt_peopletools
oracle:primavera_gateway
oracle:retail_integration_bus
oracle:retail_xstore_point_of_service
oracle:webcenter_portal

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-53x6-4x5p-rrvv	Maven	org.apache.commons:commons-compress	>=1.15 <1.19	1.19
GHSA-53x6-4x5p-rrvv	Maven	io.github.1tchy.java9modular.org.apache.commons:commons-compress	1.18.1	no fix published

References

Check your stack JSON